Privacy Policy

1. Introduction

Moongate ("we", "us", "our") is committed to protecting the personal data of individuals who interact with our practice. This Privacy Policy explains what personal information we collect, how we use it, and your rights under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").

This policy applies to visitors to our website, enquiry contacts, and clients. By using our website or providing your information, you acknowledge that your data will be handled as described in this policy.

2. Data We Collect

We may collect the following categories of personal data:

• Contact information: name, email address, telephone number
• Business information: organisation name, role, and the subject matter of your enquiry
• Communication records: messages sent via our website contact form or by email
• Usage data: IP address, browser type, pages visited, and time of visit (collected via cookies and analytics tools, where consent is given)

We collect data directly from you when you complete our contact form, send us an email, or engage with us in person or by telephone.

3. How We Use Your Data

We use personal data for the following purposes:

• To respond to enquiries and discuss potential or existing engagements
• To manage and deliver consulting services you have commissioned
• To send relevant communications about our services, where you have given consent
• To understand how our website is used and improve its content and functionality
• To comply with legal and regulatory obligations

We do not sell or share personal data with third parties for marketing purposes.

4. Legal Basis for Processing

Under applicable data protection principles, we rely on the following bases for processing personal data:

• Consent: when you submit a contact form or opt into communications
• Contract performance: when data is necessary to deliver services you have engaged us for
• Legitimate interests: for operational communications and service improvement, where these interests do not override your rights
• Legal obligation: when required to retain data for compliance purposes

5. Data Retention

We retain personal data only as long as necessary for the purpose for which it was collected:

• Enquiry data from non-clients: up to 12 months from initial contact
• Client engagement records: up to 7 years following the conclusion of an engagement (to meet our legal and professional obligations)
• Website analytics data: as per the retention settings of the analytics service used (typically 14–26 months)

Data is securely deleted or anonymised once the retention period expires.

6. Data Protection Measures

We take data security seriously and apply appropriate technical and organisational measures, including:

• Access controls limiting who within our practice can view personal data
• Encrypted communication channels for sensitive correspondence
• Secure storage with access logs and regular review
• Confidentiality obligations for all staff and contractors who handle personal data

In the event of a data breach that may affect your rights, we will notify you and the relevant authority as required under applicable law.

7. Cookies

Our website uses cookies to improve functionality and understand usage. We use essential cookies (required for the site to function) and, with your consent, analytics cookies. Please refer to our Cookie Policy for full details.

8. Third-Party Services

We may use third-party services that process personal data on our behalf, including analytics providers. These services are bound by appropriate data processing agreements. We do not allow these providers to use your data for their own purposes.

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

9. Your Rights

Under the PDPO and related data protection principles, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Request deletion of personal data where we no longer have a lawful basis to hold it
• Withdraw consent for marketing communications at any time
• Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (Hong Kong)

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

10. Children's Privacy

Our services are directed at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have done so inadvertently, we will delete that data promptly.

11. Policy Updates

We may update this policy from time to time. Material changes will be communicated by updating the date at the top of this page. Continued use of our website following any update constitutes acceptance of the revised policy.

12. Contact

For privacy-related questions or to exercise your data rights, please contact: